Google Ads Deliver Malware to Popular Text Editors
Originally Published 2 years ago — by Ars Technica
Google has been hosting a malicious ad that appears to be a legitimate pitch for the password manager Keepass. The ad leads users to a website with an almost identical URL to the genuine Keepass site, creating a convincing deception. The imposter site uses punycode encoding to appear genuine, making it difficult to detect. The ads have been running since Saturday and were paid for by an advertiser verified by Google. There is no foolproof way to detect these malicious ads or encoded URLs, but users can manually type the URL or inspect the TLS certificate for verification.